From: Hetvi Thakar <[email protected]> CVE-2018-20225 describes pip selecting the highest-version candidate across configured package indexes. Exploitation requires use of --extra-index-url with a private package absent from the public index, allowing an attacker to publish that package with an arbitrary version.
Commit [1] documents the dependency-confusion risk and recommends using --index-url for private packages. It does not change pip's candidate- selection behavior. This change records the CVE as disputed. [1] https://github.com/pypa/pip/commit/fe2721893636aa15ef04d02e9beb52f7fe9a0d27 [2] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 Signed-off-by: Hetvi Thakar <[email protected]> --- meta/recipes-devtools/python/python3-pip_24.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb index 1b6281c81f..7107b1c8df 100644 --- a/meta/recipes-devtools/python/python3-pip_24.0.bb +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb @@ -43,6 +43,7 @@ do_install:append() { } CVE_PRODUCT = "pypa:pip" +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe). -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245239): https://lists.openembedded.org/g/openembedded-core/message/245239 Mute This Topic: https://lists.openembedded.org/mt/121125671/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
